njrat | b10f27a30807f8c7e6cd91d168b092a03768882b77b2122e5598f01a5c04c0c7 | Triage

Sharing

General

Target

testme.exe
Size

93KB
Sample

241216-g3rtcsyrgl
MD5

007cc72f39b8261fda0d3ca9054f46bc
SHA1

7a2d2aaa860bced45ebdaa41eba3412c715d27fd
SHA256

b10f27a30807f8c7e6cd91d168b092a03768882b77b2122e5598f01a5c04c0c7
SHA512

2b1894aea4345bb81fa34ddad67e995b1050cbe57760ba3437733f0a7ecf3832e58bbf3cf655254c5744f13e3aa0f56ed891ab4e8d3c715aaa454ac49a565dfc
SSDEEP

1536:7x7QHRsXQQEtQnHRegjEwzGi1dDXDtgS:7xrXQQEtQnxexi1dX6

Score

10^/10

njrat hacked!discovery evasion persistence privilege_escalation

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Hacked!

C2

hakim32.ddns.net:2000

127.0.0.1:8080

Mutex

94fd569ecca6fc088d293c04362d882f

Attributes

reg_key
94fd569ecca6fc088d293c04362d882f
splitter
|'|'|

Targets

- Target
  
  testme.exe
- Size
  
  93KB
- MD5
  
  007cc72f39b8261fda0d3ca9054f46bc
- SHA1
  
  7a2d2aaa860bced45ebdaa41eba3412c715d27fd
- SHA256
  
  b10f27a30807f8c7e6cd91d168b092a03768882b77b2122e5598f01a5c04c0c7
- SHA512
  
  2b1894aea4345bb81fa34ddad67e995b1050cbe57760ba3437733f0a7ecf3832e58bbf3cf655254c5744f13e3aa0f56ed891ab4e8d3c715aaa454ac49a565dfc
- SSDEEP
  
  1536:7x7QHRsXQQEtQnHRegjEwzGi1dDXDtgS:7xrXQQEtQnxexi1dX6
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation